Free compliance
and security tools.
Five tools that do one job each, properly, without an account. Scan your cookies, generate the policies that describe them, work out what non-compliance costs, and find out how ready you actually are.
Free cookie scanner
Loads your site twice, with and without consent, and separates the trackers that fired before permission from the ones that waited.
DPDP · GDPR · CCPAPrivacy policy generator
A privacy policy that names your processors, states a lawful basis per regime, and lists the rights DPDP, GDPR and CCPA each give your users.
Pairs with the scannerCookie policy generator
Builds the cookie table most policies skip: every cookie, who sets it, what it does and how long it lives, grouped by category.
Up to ₹250 croreDPDP penalty calculator
Tick the obligations you would fail today and see the statutory maximum from the Schedule, adjusted for the factors the Board weighs.
Article 83GDPR fine calculator
Tick the obligations that would be infringed, enter turnover, and see the Article 83 ceiling per tier: the higher of €10m or 2%, or of €20m or 4%.
Up to €35m or 7%EU AI Act penalty calculator
The Article 99 and 101 ceilings for what you would breach, with the lower-of rule for SMEs and the date each obligation becomes enforceable.
Takes five minutesReadiness check
Twenty questions across six areas, scored yes, partly or no, with every gap named and nothing sent anywhere.
52 obligationsDPDP compliance checklist
Every obligation in the Act and the 2025 Rules, with the section and the date it applies. Tick what you have done and copy what is left.
Four questionsCookie consent checker
Do you need a cookie banner? A verdict for the EU and UK, India's DPDP Act, California and Brazil, from who you serve and what your site loads.
Sections 3 and 17DPDP applicability checker
Walks the Act's own scope tests and exemptions in order, and tells you which sections apply to your processing.
Section 10Significant Data Fiduciary checker
How the section 10 factors read for your business, and what designation would add. Only a government notification decides it.
6 hours to 72 hoursBreach deadline calculator
Enter when you detected an incident and get every clock that starts: CERT-In, DPDP, GDPR, RBI, SEBI and IRDAI.
Start hereWhich compliance framework do I need?
Seven questions about where you sell, who buys and what data you hold. A prioritised list: what the law requires, what contracts require, and what buyers will ask for.
By company stageStartup compliance checklist
What a startup needs at each stage, from pre-launch to the first enterprise deal, each item marked legal duty, contractual or buyer-driven.
SOC 2Do I need SOC 2?
Five questions about who you sell to and what they ask for. See whether a SOC 2 report is worth doing now, Type 1 or Type 2, and what to do first.
DevicesDo I need MDM for SOC 2 or ISO 27001?
What SOC 2, ISO 27001, HIPAA, PCI DSS and Cyber Essentials actually expect of laptops and phones, and when a full MDM is needed versus lighter evidence.
ISO 27001Do I need ISO 27001?
Voluntary for most companies, mandatory for some (SEBI-regulated firms in India). See whether certification, alignment or nothing yet fits your buyers.
PaymentsDo I need PCI compliance if I use Stripe or Razorpay?
Hosted checkout, embedded fields or your own card form: see which SAQ applies under PCI DSS v4.0.1 when you take payments through Stripe, Razorpay and similar.
HealthcareDo I need to comply with HIPAA?
Covered entity, business associate or neither. See whether HIPAA reaches you through the data you handle and the customers you serve, and what a BAA commits you to.
UKDo I need Cyber Essentials?
Whether a UK government contract or a customer needs Cyber Essentials or Plus, what the five technical controls cover, and how it fits with ISO 27001.
EU & UKDoes GDPR apply to my company?
The establishment and targeting tests of Article 3, for US, UK and Indian companies. See whether GDPR and UK GDPR apply and what you must put in place.
CaliforniaDoes CCPA apply to my business?
Check the three CCPA thresholds, including the current revenue figure, and see whether B2B and employee data put you in scope and what opt-outs you must offer.
IndiaDo I have to report this to CERT-In?
Whether an incident falls within CERT-In's 20 reportable types, who must report within six hours, and the log retention and clock rules that apply.
EU AI ActDoes the EU AI Act apply to me?
Your role (provider, deployer, importer) and your system's risk tier, with the dates as amended in 2026. Written for EU, UK, US and Indian companies.
AIDoes my startup need AI governance?
From a one-page AI use policy to a full management system: what a startup building on or using AI needs, and what customers and the EU AI Act will ask for.
AIDo I need ISO 42001?
ISO 42001 is voluntary. See when certification is worth it for an AI product, how it relates to the EU AI Act, and what to do before buyers ask.
EUDoes NIS2 apply to me?
Sector, size and location tests, essential or important entity, and the 24-hour reporting duty. Includes suppliers pulled in by their customers' contracts.
EU financeDoes DORA apply to me?
For EU financial firms and the SaaS and ICT vendors serving them: whether DORA applies to you directly, and the Article 30 contract terms a bank will send.
Every tool here runs in your browser. Nothing you type is sent to us, nothing is stored, and none of them ask for an email address first. The cookie scanner is the one exception: it loads your site from our infrastructure, because that is the only way to see what your site actually does.
Which one you need
The tools answer different questions and they chain in a particular order. Running them out of order mostly wastes time: you cannot write an accurate cookie policy before you know what your site sets, and there is little point pricing penalties before you know which obligations you miss.
| If you are asking | Use | It takes |
|---|---|---|
| What is my site actually doing to visitors? | Cookie scanner | A minute or two, runs a real browser |
| Do we need a cookie banner at all? | Cookie consent checker | One minute, four questions |
| What do I publish to describe it? | Cookie policy generator | Five minutes, after a scan |
| What do I publish about personal data generally? | Privacy policy generator | Ten minutes |
| How exposed am I if this goes wrong? | Penalty calculator | Two minutes |
| Where do I actually stand? | Readiness check | Five minutes, twenty questions |
| Does the DPDP Act apply to us at all? | Applicability checker | Three minutes |
| What exactly do we have to do under DPDP? | DPDP compliance checklist | As long as it takes; progress is saved |
| We have an incident. Who do we tell, and by when? | Breach deadline calculator | One minute |
Why these are free, and what the catch is
There is no email gate, no account and no trial clock on any of them, and that is deliberate rather than generous. A tool that tells you something true about your own site is a better argument for the platform than any amount of marketing copy, and a tool that demands an email before showing a result is telling you it has nothing to show.
The honest limitation is this: four of the five generate a document or a score from what you tell them. That is genuinely useful and it is not the same thing as compliance. A generated policy describes what you say your systems do; a readiness score records what you believe about them. Neither observes the systems themselves. The scanner is the exception, and it is the exception because it actually loads your site and watches what happens.
Closing that gap, between documents that describe intentions and evidence that records behaviour , is what the platform does, and it is the only thing here we charge for.
Where your data goes
Four of the five tools run entirely in your browser. Nothing you type is transmitted to us, stored, or logged, and you can verify that with your browser's network tab open. The consequence is that we also cannot retrieve your work later, so download or copy anything you want to keep.
The cookie scanner is different by necessity: it loads your site from our infrastructure, because that is the only way to observe what your pages do to a real visitor. It reads the URL you give it and nothing else, and it does not require you to install anything or verify domain ownership.
The things people ask us
Are these tools really free, with no account?
Yes. No signup, no email gate, no trial period and no credit card. The four generators run entirely in your browser; the cookie scanner runs on our infrastructure and still asks for nothing but the URL.
Will a generated document make me compliant?
No, and it is worth being blunt about it. These tools produce a well-structured document from what you tell them. Compliance is whether your systems actually behave that way. A policy that describes intentions rather than the system as built is the single most common finding in a privacy review.
Which tool should I start with?
The cookie scanner, almost always. It is the only one that observes your site rather than asking you about it, so it tends to surface something you did not know within two minutes, and its output feeds the cookie policy generator directly.
Do you store what I type into the generators?
No. They are client-side JavaScript with no network calls, which you can confirm in your browser's network tab. That also means nothing is recoverable afterwards, so save what you generate.
Can I use the generated documents commercially?
Yes, on your own site and under your own name, with no attribution required. They are starting points written to be edited, and they should be reviewed by counsel against how your organisation actually processes data before you publish.
The tools tell you. The platform proves it.
A generated document says what you intend to do. The control graph shows what your systems are doing, continuously, with the evidence attached.